Cinder API server disagrees with USE_SSL=True

[Guang Yee]

I am using a Ubuntu 14.04 VM to play with devstack. To reproduce the bug:

1. copy the sample local.conf to devstack root dir
2. add USE_SSL=True
3. run stack.sh and you'll encounter this

2016-01-13 19:04:55.008 | + openstack volume type create --property volume_backend_name=lvmdriver-1 lvmdriver-1
2016-01-13 19:05:07.059 | SSL exception connecting to https://192.168.1.28:8776/v1/8e52aacb570c4c02902b4a5e0cdd1aa7/types: [Errno 1] _ssl.c:510: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol
2016-01-13 19:05:07.115 | + exit_trap

Cinder eventlet server does not appear to support SSL at all (i.e. it does not convey the use_ssl param to oslo.service).

https://github.com/openstack/cinder/blob/master/cinder/service.py#L376
https://github.com/openstack/oslo.service/blob/master/oslo_service/wsgi.py#L81

If I understand the code correct, the only way to enable SSL for Cinder API server would be to run in in Apache mod_wsgi

CINDER_USER_MOD_WSGI=True

Unfortunately, setting the above, in conjunction with USE_SSL=True wont' work either because we are checking specifically for c-api, not cinder service, when configuring the SSL options in mod_wsgi.

https://github.com/openstack-dev/devstack/blob/master/lib/cinder#L210

We don't seem to distinguish c-api and c-volume for enabling SSL for Cinder as a whole. So we have two choices,

1. continue on the current path and treat Cinder as a whole when deciding on whether to enable SSL. In other words, if USE_SSL is set to True for Cinder, both c-api and c-volume will get SSL
2. treat c-api and c-volume as separate services, just like how Swift is doing it

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/267249

[OpenStack Infra (hudson-openstack)]

Change abandoned by guang-yee (<email address hidden>) on branch: master
Review: https://review.openstack.org/267249
Reason: Not relevant enough to care.

[Sean Dague (sdague)]

No open reviews found in this bug, unassigning. Please add a comment with active reviews before assigning an individual, or tag the bug in the gerrit review, which will do that automatically. We try not to assign bugs without patches as that discourages other folks from looking into bugs.

[Sean Dague (sdague)]

no currently active